Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2022-26344HIGHIncorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enEPSS 0.2%CVE-2023-42774MEDIUMLiteos-A has a incorrect default permissions vulnerabilityEPSS 0.2%CVE-2024-51440HIGHAn issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component.EPSS 0.2%CVE-2024-8037MEDIUMVulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with acEPSS 0.2%CVE-2022-4568HIGHA directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.EPSS 0.2%CVE-2022-44548MEDIUMThere is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may EPSS 0.2%CVE-2026-26034HIGHUPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that alloEPSS 0.2%CVE-2022-23454HIGHPotential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromEPSS 0.2%CVE-2022-23453HIGHPotential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromEPSS 0.2%CVE-2023-4088CRITICALMalicious Code Execution Vulnerability in FA Engineering Software ProductsEPSS 0.2%CVE-2023-3116HIGHLiteos-A has a incorrect default permissions vulnerabilityEPSS 0.2%CVE-2025-54530HIGHIn JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissionsEPSS 0.2%CVE-2022-36367MEDIUMIncorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentiallEPSS 0.2%CVE-2025-24915HIGHWhen installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permiEPSS 0.2%CVE-2026-25931HIGHvscode-spell-checker has a workspace-trust bypass Code ExecutionEPSS 0.2%CVE-2024-29962MEDIUMInsecure file permission setting that makes files world-readableEPSS 0.2%CVE-2023-35181HIGHSolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2024-10469MEDIUMCERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.EPSS 0.2%CVE-2022-43701HIGHInsecure directory permissions on installer filesEPSS 0.2%CVE-2023-38295HIGHCertain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permissiEPSS 0.2%